High Contrast mode - users getting stuck

[glennda]

We've disabled users being able to change the windows 7 theme via GPO and when the users do the shortcut keys(ALT + left SHIFT + PRINT SCREEN) but students can get themselves into high contrast mode but cannot get themselves out of this mode.

 

Any body know a way of either disabling high contrast? or take it off without needing to enable them to change the theme.

[DaveyPitch]

If the pupils have turned on High Contrast mode via the shortcut keys then they should be able to disable it the same way. I don't think you can strictly disable it, but you can disable the shortcut keys which should do the job for you. Go to Control Panel -> Ease of Access Centre -> Make the computer easier to see, then untick the box at the top.

[glennda]

yes but the shortcut key doesn't take them off thats the whole point - it leaves them in high contrast - the only way to resolve is reset the profile.

 

They only have access to Devices and Printers in Control Panel.

[DaveyPitch]

Ah yes, I see what you mean, just tested it myself and it didn't revert back to my standard theme, I had to change it manually back. That's rather annoying :/

[glennda]

Ah yes, I see what you mean, just tested it myself and it didn't revert back to my standard theme, I had to change it manually back. That's rather annoying :/

I'm going to investigate a little more in a second.

 

I can't seem to find anything to disable the shortcut keys. Everything i search seems to find lots of people with similar problems!

[DaveyPitch]

Here's a thought - do you actually need the High Contrast themes at all? If not, couldn't you just delete them from each computer? You could set up a GPO to do that for you.

[glennda]

do you know where they are located?

[DaveyPitch]

Yup - c:\windows\resources\ease of access themes

[badders]

If the user locks the PC then clicks the ease of access icon in the bottom left hand corner, they can then untick any of the settings and apply then log back on. Sometimes the settiings need to be selected and then unselected before they appy.

[glennda]

If the user locks the PC then clicks the ease of access icon in the bottom left hand corner, they can then untick any of the settings and apply then log back on. Sometimes the settiings need to be selected and then unselected before they appy.

 

they can't lock the pc

[glennda]

Just tried to delete using Group policy preferences - access denied?

[DaveyPitch]

Just checked, it's because the file is owned by TrustedInstaller, and I couldn't even manually delete it. Looks like you'd need to run a script using takeown.exe to give ownership of the file to the Administrators group, then to delete the file. If you write it as a batch file you could probably make it part of your logon script.

[glennda]

yeah will try and do a startup script later.

[DaveyPitch]

Right, just tested it on my machine, and not only do you have to take ownership of the file, you still have to grant yourself permissions as well. This is the script I used....

 

takeown /f "c:\windows\resources\ease of access themes" /a /r
icacls "c:\windows\resources\ease of access themes\*" /grant Everyone:(F)
del "c:\windows\resources\ease of access themes\*.*" /q

 

Hope that helps a bit

[ihaveaproblem]

Disable Sticky Keys and High Contrast - Wiki

 

Disable sticky keys and high contrast. Works well for me.

If you want to disable high contrast from the login screen you can do this (Be aware it disables all accessibility tool features such as the on screen keyboard, so only apply if your certain you don’t need)

 

Computer -- windows settings -- security settings -- file system

 

Add = %SystemRoot%\System32\Utilman.exehide

In the security settings for the file add everyone and deny read and execute. Apply and ok it and then click 'replace existing permissions on all subfolders and files'

[glennda]

I just deleted the files in a startup script as above

 

All works great

[DaveyPitch]

Excellent, glad it worked for you

[Gongalong]

I have tried the file deletion method but it isn't working.

 

It's in as a .bat file within GPO for student logon, but does not delete any files.

 

If I login as a local admin and run the .bat file manually then all the files are deleted.

 

Any ideas why this is occurring?

 

This high contrast thing for students is getting really boring (requires frequent profile deletions)!

 

TIA

[glennda]

Do it as a startup script rather then login

[Gongalong]

Thanks. That worked

[glennda]

Its saved my life this - we where having to reset about 15 profiles a day due to this!

 

Now its bliss

[ZeroHour]

As a general rule dont delete files, just deny the users group access using GP. When you go to patch and windows finds its missing standard files things can break/not install.

[Gongalong]

glennda: not quite so bad here, but very frustrating.

 

ZeroHour: the script has been activated here, so too late technically. Albeit I could setup another script to copy them back I suppose.

[ZeroHour]

glennda: not quite so bad here, but very frustrating.

 

ZeroHour: the script has been activated here, so too late technically. Albeit I could setup another script to copy them back I suppose.

 

I would personally and then use GP to deny a common users group (I would leave trusted installer and SYSTEM access though) that way any patches wont fail. Service packs will fail if they touch the files at least anyway as well. As long as you know you could have issues you can spot the problem.

[JamesG]

simply find out when the mode was first switched on, punish the user for what he did then none of them will do it again.

 

simples